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Description 

BACKGROUND OF THE INVENTION 

5 1 . Field of the Invention 

This invention relates generally to the detection of fraudulent use of customer accounts and account numbers, 
including for example credit card transactions. In particular, the invention relates to an automated fraud detection system 
and method that uses predictive modeling to perform pattern recognition and classification in order to isolate transac- 
io tions having high probabilities of fraud. 

2. Description of the Related Art 

In the following discussion, the term "credit card" will be used for illustrative purposes; however, the techniques 
15 and principles discussed herein apply to other types of customer accounts, such as charge cards, bank automated 
teller machine cards and telephone calling cards. 

Credit card issuers conventionally attempt to limit fraud losses by immediately closing a customer's account upon 
receiving a report that the card has been lost or stolen. Typically, the customer's credit information is then transferred 
to a new account and a new card is issued. This procedure is only effective in limiting fraudulent use of lost or stolen 
20 cards after the loss or theft has been reported to the issuer. 

In many cases, however, fraudulent use occurs without the knowledge of the cardholder, and therefore no report 
is made to the issuer. This may occur if the customer is unaware that the card has been lost or stolen, or if other 
techniques are employed to perpetrate the fraud, such as: use of counterfeit cards; merchant fraud; application fraud; 
or interception of credit cards in the mail. In all these situations, the fraudulent use may not be detected until (and 
25 unless) the cardholder notices an unfamiliar transaction on his or her next monthly statement and contests the corre- 
sponding charge. The concomitant delay in detection of fraud may result in significant losses. User fraud, in which the 
user claims that a valid transaction is invalid, is also possible. 

Issuers of credit cards have sought to limit fraud losses by attempting to detect fraudulent use before the cardholder 
has reported a lost or stolen card. One conventional technique is known as parameter analysis. A parameter analysis 
30 fraud detection scheme makes a decision using a small number of database fields combined in a simple Boolean 
condition. An example of such a condition is: 

if (number of transactions in 24 hours > X) and (more than Y dollars authorized) then flag this account as high risk 
Parameter analysis will provide the values of X and Y that satisfy either the required detection rate or the required 
false positive rate. In a hypothetical example, parameter values of X=400 and Y=1000 might capture 20% of the frauds 
3S with a false positive rate of 200: 1 , while X=6 and Y-2000 might capture 8% of the frauds with a false positive rate of 20:1 . 

The rules that parameter analysis provides are easily implemented in a database management system, as they 
are restricted to Boolean (e.g., and, or) combinations of conditions on single variables. 

Parameter analysis derives rules by examining the single variables most able to distinguish fraudulent from non- 
fraudulent behavior. Since only single-variable threshold comparisons are used, complex interactions among variables 
40 are not captured. This is a limitation that could cause the system to discriminate poorly between fraudulent and valid 
account behavior, resulting in low capture rates and high false-positive rates. 

Additionally, an effective fraud detection model generally requires more variables than conventional parameter 
analysis systems can handle. Furthermore, in order to capture new fraud schemes, parameter analysis systems must 
be redeveloped often, and automated redevelopment is difficult to implement. 
45 One prior art document, WO-A-8906398, describes a device for analyzing a data processing transaction by: extracting 
only those data usefull for analysis of the trans-action; deleting signals corresponding to the transaction deemed to 
comply with a set of predetermined rules; filtering to eliminate non-significant variations of the transaction to be ana- 
lyzed; and classifying signals to one or more classes according to a predetermined criteria. This device is susceptible 
to applicticn to delivery of payment authorizations to credit card users. Another document, EP-A-0 418 144, describes 
50 a method of limiting risks associated with a computerized transaction by comparing the transaction request with pre- 
determined statistical data representative of evaluation of a risk of non-conforming utilization. The statistical data de- 
scribes the mean number or amount of transactions effected during the course of successive time periods, and is 
derived by dividing time into consecutive unequal periods whose durations are chosen such that the probability of a 
transaction being effected or a mean amount being requested during a course of each of the time periods is basically 
55 consistent. 

It is desirable, therefore, to have an automated system that uses available information regarding cardholders, 
merchants, and transactions to screen transactions and isolate those which are likely to be fraudulent, and which 
captures a relatively high proportion of frauds while maintaining a relatively low false-positive rate. Preferably, such a 
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system should be able to handle a large number of interdependent variables, and should have capability for redevel- 
opment of the underlying system model as new patterns of fraudulent behavior emerge. 

Accordingly, the present invention provides a computer-implemented process for identifying and determining fraudulent 
transaction data according to the features of claim 1 and a computer-controlled transaction processing system accord- 
s ing to the features of claim 1 2. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 is a block diagram of an implementation of the present invention. 
10 Figure 2 is a sample system monitor screen which forms part of a typical output interface for the present invention. 

Figure 3 is a sample account selection screen which forms part of a typical output interface for the present invention. 
Figure 4 is a sample transaction analysis screen which forms part of a typical output interface for the present 
invention. 

Figure 5 is a sample customer information screen which forms part of a typical output interface for the present 
is invention. 

Figure 6 is a sample analyst response screen which forms part of a typical output interface for the present invention. 

Figure 7 is a flowchart illustrating the major functions and operation of the present invention. 

Figure 8 is a block diagram showing the overall functional architecture of the present invention. 

Figure 9 is a diagram of a single processing element within a neural network. 
20 Figure 10 is a diagram illustrating hidden processing elements in a neural network. 

Figure 11 is a flowchart of the pre-processing method of the present invention. 

Figure 12 is a flowchart of the method of creating a profile record of the present invention. 

Figure 13 is a flowchart of the method of updating a profile record of the present invention. 

Figure 14 is a flowchart showing operation of a batch transaction processing system according to the present 
25 invention. 

Figure 15 is a flowchart showing operation of a semi-real-time transaction processing system according to the 
present invention. 

Figure 16 is a flowchart showing operation of a real-time processing system according to the present invention. 
Figure 17 is a flowchart showing the overall operation of the transaction processing component of the present 
30 invention. 

Figure 18 is a flowchart showing the operation of module CSCORE of the present invention. 
Figure 19 is a flowchart showing the operation of DeployNet of the present invention. 
Figure 20 is a flowchart showing cascaded operation of the present invention. 
Figure 21 is a portion of a typical CFG model definition file. 

35 

DESCRIPTION OF THE PREFERRED EMBODIMENT 

The Figures depict preferred embodiments of the present invention for purposes of illustration only. One skilled in 
the art will readily recognize from the following discussion that alternative embodiments of the structures and methods 

40 illustrated herein may be employed without departing from the principles of the invention described herein. 

Referring now to Figure 1 , there is shown a block diagram of a typical implementation of a system 1 00 in accordance 
with the present invention. Transaction information is applied to system 100 via data network 105, which is connected 
to a conventional financial data facility 1 06 collecting transaction information from conventional sources such as human- 
operated credit-card authorization terminals and automated teller machines (not shown). CPU 101 runs software pro- 

45 gram instructions, stored in program storage 107, which direct CPU 101 to perform the various functions of the system. 
In the preferred embodiment, the software program is written in the ANSI C language, which may be run on a variety 
of conventional hardware platforms. In accordance with the software program instructions, CPU 101 stores the data 
obtained from data network 105 in data storage 103, and uses RAM 102 in a conventional manner as a workspace. 
CPU 101, data storage 103, and program storage 107 operate together to provide a neural network model 108 for 

50 predicting fraud. After neural network 108 processes the information, as described below, to obtain an indication of the 
likelihood of fraud, a signal indicative of that likelihood is sent from CPU 101 to output device 104. 

In the preferred embodiment, CPU 101 is a Model 3090 IBM mainframe computer, RAM 102 and datastorage 103 
are conventional RAM, ROM and disk storage devices for the Model 3090 CPU , and output device 1 04 is a conventional 
means for either printing results based on the signals generated by neural network 108, or displaying the results on a 

5S video screen using a window-based interface system, or sending the results to a database for later access, or sending 
a signal dependent on the results to an authorization system (not shown) for further processing. 

Referring now also to Figures 2 through 6, there are shown sample screens from a conventional window-based 
interface system (not shown) which forms part of output device 104. Figure 2 shows system monitor 201 that allows 
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a fraud analyst or system supervisor to review system performance. System monitor 201 shows a cutoff score 202 
above which accounts will be flagged, the number of accounts with scores above the cutoff 203, and the fraud score 
204 and account number 205 for a particular account. 

Figure 3 shows account selection screen 301 that includes a scrolling window 302 allowing the analyst to select 
5 high-risk transactions for review, and a set of buttons 303 allowing the analyst to select further operations in connection 
with the selected transactions. 

Figure 4 shows transaction analysis screen 401 that allows the fraud analyst to examine each high-risk transaction 
and determine appropriate fraud control actions. It includes account information 402, fraud score 403, explanations 
derived from reason codes 404 that indicate the reasons for fraud score 403, and two scrolling windows 405 and 406 
to that show transaction information for the current day and the past seven days 405, and for the past six months 406. 

Figure 5 shows customer information screen 501 that allows the analyst to access customer information, including 
account number 502, customer names 503, best time to call 504, phone numbers 505, and address 506. It also provides 
access to further functions via on-screen buttons 507. 

Figure 6 shows analyst response screen 601 that allows the analyst to log actions taken to control fraud. It includes 
is a series of check boxes 602 for logging information, a comment box 603, and on-screen buttons 604 allowing access 
to other functions. 

Referring now also to Figure 7, there is shown an overall flowchart illustrating the major functions and operation 
of the system 100. First neural network model 108 is trained 701 using data describing past transactions from data 
network 105. Then data describing the network model are stored 702. Once the model description is stored, system 
20 100 is able to process current transactions. System 100 obtains data for a current transaction 703, and applies the 
current transaction data to the stored network model 704. The model 108 determines a fraud score and reason codes 
(described below), which are output 705 to the user, or to a database, or to another system via output device 1 04. 

Referring now to Figure 8, the overall functional architecture of system 100 is shown. System 100 is broken down 
into two major components: model development component 801 and transaction processing component 802. Model 
25 development component 801 uses past data 804 to build neural network 108 containing information representing 
learned relationships among a number of variables. Together, the learned relationships form a model of the behavior 
of the variables. Although a neural network is used in the preferred embodiment, any type of predictive modeling 
technique may be used. For purposes of illustration, the invention is described here in terms of a neural network. 
Transaction processing component 802 performs three functions: 1) it determines the likelihood of fraud for each 
30 transaction by feeding data from various sources 805, 806 into neural network 108, obtaining results, and outputting 
them 807; 2) when applicable, it creates a record in a profile database 806 summarizing past transactional patterns of 
the customer; and 3) when applicable, it updates the appropriate record in profile database 806. 
Each of the two components of the system will be described in turn. 

35 Model Development Component 801 

Neural Networks: Neural networks employ a technique of "learning" relationships through repeated exposure to 
data and adjustment of internal weights. They allow rapid model development and automated data analysis. Essentially, 
such networks represent a statistical modeling technique that is capable of building models from data containing both 

40 linear and non-linear relationships. While similar in concept to regression analysis, neural networks are able to capture 
non linearity and interactions among independent variables without pre-specification. In other words, while traditional 
regression analysis requires that nonlinearities and interactions be detected and specified manually, neural networks 
perform these tasks automatically. For a more detailed description of neural networks, see D.E. Rumelhart et al, "Learn- 
ing Representations by Back-Propagating Errors", Nature v. 323, pp. 533-36 (1986), and R. Hecht-Nielsen, -Theory 

45 of the Backpropagation Neural Network", in Neural Networks for Perception , pp. 65-93 (1 992), the teachings of which 
are incorporated herein by reference. 

Neural networks comprise a number of interconnected neuron-like processing elements that send data to each 
other along connections. The strengths of the connections among the processing elements are represented by weights. 
Referring now to Figure 9, there is shown a diagram of a single processing element 901. The processing element 

so receives inputs X v X 2 ,... X n , either from other processing elements or directly from inputs to the system. It multiplies 
each of its inputs by a corresponding weight w 1( w 2 , .. . w n and adds the results together to form a weighted sum 902. 
It then applies a transfer function 903 (which is typically non-linear) to the weighted sum, to obtain a value Z known as 
the state of the element. The state Z is then either passed on to another element along a weighted connection, or 
provided as an output signal. Collectively, states are used to represent information in the short term, while weights 

55 represent long-term information or learning- 
Processing elements in a neural network can be grouped into three categories: input processing elements (those 
which receive input data values); output processing elements (those which produce output values); and hidden process- 
ing elements (all others). The purpose of hidden processing elements is to allow the neural network to build intermediate 
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representations that combine input data in ways that help the model learn the desired mapping with greater accuracy. 
Referring now to Figure 10, there is shown a diagram illustrating the concept of hidden processing elements. Inputs 
1001 are supplied to a layer of input processing elements 1002. The outputs of the input elements are passed to a 
layer of hidden elements 1003. Typically there are several such layers of hidden elements. Eventually, hidden elements 
5 pass outputs to a layer of output elements 1004, and the output elements produce output values 1005. 

Neural networks learn from examples by modifying their weights. The "training" process, the general techniques 
of which are well known in the art, involves the following steps: 

1) Repeatedly presenting examples of a particular input/output task to the neural network model; 
10 2) Comparing the model output and desired output to measure error; and 

3) Modifying model weights to reduce the error. 

This set of steps is repeated until further iteration fails to decrease the error. Then, the network is said to be "trained. 
" Once training is completed, the network can predict outcomes for new data inputs. 

15 

Fraud-Related Variables 

In the present invention, data used to train the model are drawn from various database files containing historical 
data on individual transactions, merchants, and customers. These data are preferably pre-processed before being fed 
20 into the neural network, resulting in the creation of a set of fraud-related variables that have been empirically determined 
to form more effective predictors of fraud than the original historical data. 

Referring now to Figure 11, there is shown a flowchart of the pre-processing method of the present invention. 
Individual elements of the flowchart are indicated by designations which correspond to module names. 

Data used for pre-processing is taken from three databases which contain past data: 1 ) past transaction database 
25 1101 (also called an "authorization database") containing two years' worth of past transaction data, which may be 
implemented in the same data base as past data 804; 2) customer database 1103 containing customer data; and 3) 
fraud database 1102 which indicates which accounts had fraudulent activity and when the fraudulent activity occurred. 

Module readauth.sas 1104 reads transaction data from past transaction database 1101. Module matchauth.sas 
1105 samples this transaction data to obtain a new transaction data set containing all of the fraud accounts and a 
30 randomly-selected subset of the non-fraud accounts. In creating the new transaction data set, module matchauth.sas 
1 1 05 uses information from fraud database 1 1 02 to determine which accounts have fraud and which do not. For effective 
network training, it has been found preferable to obtain approximately ten non-fraud accounts for every fraud account. 

Module readex.sas 1106 reads customer data from customer database 1103. Module matchex. sas 1107 samples 
this customer data to obtain a new customer data set containing all of the fraud accounts and the same subset of non- 
35 fraud accounts as was obtained by module matchauth.sas. In creating the new customer data set, module matchex. 
sas 1107 uses information from fraud database 1102 to determine which accounts have fraud and which do not. 

Module mxmerge.sas 1108 merges all of the data sets obtained by modules matchauth.sas 1105 and matchex. 
sas 1107. Module genau.sas 1109 subdivides the merged data set into subsets of monthly data. 

Module gensamp.sas 1112 samples the data set created by module mxmerge.sas 1108 and subdivided by genau. 
40 sas 1109, and creates a new data set called sample.ssd where each record represents a particular account on a 
particular day with transaction activity. Module gensamp.sas 1112 determines which records are fraudulent using in- 
formation from fraud database 1102. Module gensamp.sas 1112 provides a subset of authorization days, as follows: 
From the database of all transactions, a set of active account-days is created by removing multiple transactions for 
the same customer on the same day. In the set of active account -days, each account day is assigned a "draft number" 
45 from 0 to 1 . This draft number is assigned as follows: If the account-day is non-fraudulent, then the draft number is set 
to a random number between 0 and 1 . If the account-day is fraudulent and it lies on the first or second day of fraud, 
then the draft number is set to 0. Otherwise, it is set to 1 . Then, the 25,000 account-days with the smallest draft numbers 
are selected for inclusion in sample.ssd. Thus, all fraudulent account-days (up to 25,000) plus a sample of non-fraud- 
ulent account-days are included in sample.ssd. 
50 Module roll 15. sas 1113 generates a 15-day rolling window of data. This data has multiple records for each account- 

day listed in sample.ssd. The current day and 14 preceding days are listed for each sample account. 

Module roll15to7.sas 1117 takes the roll15data set and filters out days eight to 15 to produce roll7, a 7-day rolling 
window data set 1119. Days eight to 15 are ignored. Module genrolv.sas 1118 generates input variables for a rolling 
window of the previous 15 days of transactions. It processes a data set with multiple and variable numbers of records 
55 per account and produces a data set with one record per account. The result is called rollv.ssd. 

Module roll15to1.sas 1114 takes the roll15 data set and filters out days except the current day to produce rolH. 
Module gencurv.sas 1115 uses rolh to generate current day variables 1116 describing transactions occurring during 
the current day. 
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Module genprof.sas generates profile variables which form the profile records 1111. 

Module merge. sas 1120 combines the profile records 1111, 1-day variables 1116, and 7-day variables 1119 and 
generates new fraud-related variables, as listed below, from the combination. It also merges rollv.ssd with the sample- 
filtered profile data sets to produce a single data set with both profile and rolling window variables. The result is called 
5 the mod1n2 data set 1121 (also called the "training set"), which contains the fraud-related variables needed to train 
the network. Scaler module 1122 scales the variables such that the mean value for each variable in the scaled training 
set is 0.0 and the standard deviation is 1 .0, to create scaled modi n2 data set 1123. 

Many fraud-related variables may be generated using variations of the pre-processing method described above. 
Fraud-related variables used in the preferred embodiment include: 

10 

° Customer usage pattern profiles representing time-of-day and day-of-week profiles; 
» Expiration date for the credit card; 

• Dollar amount spent in each SIC (Standard Industrial Classification) merchant group category during the current 
day; 

is o Percentage of dollars spent by a customer in each SIC merchant group category during the current day; 
o Number of transactions in each SIC merchant group category during the current day; 
o Percentage of number of transactions in each SIC merchant group category during the current day; 

• Categorization of SIC merchant group categories by fraud rate (high, medium, or low risk); 

• Categorization of SIC merchant group categories by customer types (groups of customers that most frequently 
20 use certain SIC categories); 

• Categorization of geographic regions by fraud rate (high, medium, or low risk); 
° Categorization of geographic regions by customer types; 

o Mean number of days between transactions; 
o Variance of number of days between transactions; 
25 o Mean time between transactions in one day; 

• Variance of time between transactions in one day; 

o Number of multiple transaction declines at same merchant; 

• Number of out-of-state transactions; 

o Mean number of transaction declines; 
30 o Year-to-date high balance; 

• Transaction amount; 

• Transaction date and time; 
o Transaction type. 

35 Additional fraud-related variables which may also be considered are listed below: 

Current Day Cardholder Fraud Related Variables 

bweekend - current day boolean indicating current datetime considered weekend 
40 cavapvdl - current day mean dollar amount for an approval 
cavapvdl - current day mean dollar amount for an approval 
cavaudl - current day mean dollars per auth across day 

ccoscdom - current day cosine of the day of month i.e. cos(day ((datepart(cst_dt)* &TWOPI)/30)); 

ccoscdow - current day cosine of the day of week i.e. cos(weekday((datepart(cst_dt)* &TWOPI)/7)); 
45 ccoscmoy - current day cosine of the month of year i.e. cos(month ((datepart(cst_dt)* &TWOPI)/12)); 

cdom - current day day of month 

cdow - current day day of week 

chdzip - current cardholder zip 

chibal - current day high balance 
so chidcapv - current day highest dollar amt on a single cash approve 

chidcdec - current day highest dollar amt on a single cash decline 

chidmapv - current day highest dollar amt on a single merch approve 

chidmdec - current day highest dollar amt on a single merch decline 

chidsapv - current day highest dollar amount on a single approve 
ss chidsau - current day highest dollar amount on a single auth 

chidsdec - current day highest dollar amount on a single decline 

cmoy - current day month of year 

cratdcau - current day ratio of declines to auths 
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10 



25 



30 



40 



45 



55 



csincdom - 
csincdow - 
csincmoy - 
cst_dt - 
ctdapv - 
ctdau - 
ctdcsapv - 
ctdcsdec - 
ctddec - 
ctdmrapv - 
ctdmrdec - 
ctnapv - 
ctnau - 
ctnaulOd - 
ctnaudy - 
ctncsapv - 
ctncsapv - 
ctncsdec - 
ctndec - 
ctnmrapv - 
ctnmrdec - 
ctnsdapv - 
ctnwdaft - 
ctnwdapv - 
ctnwdeve - 
ctnwdmor - 
ctnwdnit - 
ctnweaft - 
ctnweapv 
ctnweeve 
ctnwemor 
ctnwenit 
currbal 
cvrandt 
czrate 1 
czrate2 
czrate3 
czrate4 
czrate5 
czrate6 
czrate7 
czrate8 
ctdsfaOl 
ctdsfa02 
ctdsfa03 
ctdsfa04 
ctdsfaOS 
ctdsfa06 
ctdsfa07 
ctdsta08 
ctdsfa09 
ctdsfalO 
ctdsfa11 
ctdsraOl 
ctdsra02 
ctdsra03 
ctdsra04 
ctdsraOS 



current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 



day sine of the day of month i.e. sin(day ((datepart(cst_dt)* &TWOP1)/30)); 

day sine of the day of week i.e. sin(weekday((datepart(cst_dt)* &TWOPI)y7)); 

day sine of the month of year i.e. sin(month ((datepart(cst_dt)* &TWOPI)/12)); 

day est datetime derived from zip code and CST auth time 

day total dollars of approvals 

day total dollars of auths 

day total dollars of cash advance approvals 

day total dollars of cash advance declines 

day total dollars of declines 

day total dollars of merchandise approvals 

day total dollars of merchandise declines 

day total number of approves 

day total number of auths 

day number of auths in day<=$10 



total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 



day current balance 

day variance of dollars per auth across day 
day zip risk group 1 'Zip very high fraud rate' 
day zip risk group 2 'Zip high fraud rate' 
day zip risk group 3 'Zip medium high fraud rate' 
day zip risk group 4 'Zip medium fraud rate' 
day zip risk group 5 'Zip medium low fraud rate' 
day zip risk group 6 'Zip low fraud rate' 
day zip risk group 7 'Zip very low fraud rate' 
day zip risk group 8 'Zip unknown fraud rate' 



day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 
day total dollars ol 



transactions in SIC factor group 01 
transactions in SIC factor group 02 
transactions in SIC factor group 03 
transactions in SIC factor group 04 
transactions in SIC factor group 05 
transactions in SIC factor group 06 
transactions in SIC factor group 07 
transactions in SIC factor group 08 
transactions in SIC factor group 09 
transactions in SIC factor group 10 
transactions in SIC factor group 11 
transactions in SIC fraud rate group 01 
transactions in SIC fraud rate group 02 
transactions in SIC fraud rate group 03 
transactions in SIC fraud rate group 04 
transactions in SIC fraud rate group 05 
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ctdsra06 current day total dollars of transactions in SIC fraud rate group 06 

ctdsra07 current day total dollars of transactions in SIC fraud rate group 07 

ctdsvaOl current day total dollars in SIC VISA group 01 

ctdsva02 current day total dollars in SIC VISA group 02 

5 ctdsva03 current day total dollars in SIC VISA group 03 

ctdsva04 current day total dollars in SIC VISA group 04 

ctdsvaOS current day total dollars in SIC VISA group 05 

ctdsva06 current day total dollars in SIC VISA group 06 

ctdsva07 current day total dollars in SIC VISA group 07 

10 ctdsva08 current day total dollars in SIC VISA group 08 

ctdsva09 current day total dollars in SIC VISA group 09 

ctdsvalO current day total dollars in SIC VISA group 10 

ctdsval 1 current day total dollars in SIC VISA group 11 

ctnsfaOl current day total number of transactions in SIC factor group 01 

15 ctnsfa02 current day total number of transactions in SIC factor group 02 

ctnsfa03 current day total number of transactions in SIC factor group 03 

ctnsfa04 current day total number of transactions in SIC factor group 04 

ctnsfaOS current day total number of transactions in SIC factor group 05 

ctnsfa06 current day total number of transactions in SIC factor group 06 

20 ctnsfa07 current day total number of transactions in SIC factor group 07 

ctnsfa08 current day total number of transactions in SIC factor group 08 

ctnsfa09 current day total number of transactions in SIC factor group 09 

ctnsfalO current day total number of transactions in SIC factor group 10 

ctnsfal 1 current day total number of transactions in SIC factor group 11 

25 ctnsraOl current day total number of transactons in SIC fraud rate group 01 

ctnsra02 current day total number of transactons in SIC fraud rate group 02 

ctnsra03 current day total number of transactons in SIC fraud rate group 03 

ctnsra04 current day total number of transactons in SIC fraud rate group 04 

ctnsraOS current day total number of transactons in SIC fraud rate group 05 

30 ctnsra06 current day total number of transactons in SIC fraud rate group 06 

ctnsra07 current day total number of transactons in SIC fraud rate group 07 

ctnsvaOl current day total number in SIC VISA group 01 

ctnsva02 current day total number of SIC VISA group 02 

ctnsva03 current day total number of SIC VISA group 03 

35 ctnsva04 current day total number of SIC VISA group 04 

ctnsvaOS current day total number of SIC VISA group 05 

ctnsva06 current day total number of SIC VISA group 06 

ctnsva07 current day total number of SIC VISA group 07 

ctnsva08 current day total number of SIC VISA group 08 

40 ctnsva09 current day total number of SIC VISA group 09 

ctnsvalO current day total number of SIC VISA group 10 

ctnsval 1 current day total number of SIC VISA group 11 



7 Day Cardholder Fraud Related Variables 



55 



raudymdy 7 day ratio of auth days over number of days in the window 

ravapvdl 7 day mean dollar amount for an approval 

ravaudl 7 day mean dollars per auth across window 

rddapv 7 day mean dollars per day of approvals 

rddapv2 7 day mean dollars per day of approvafs on days with auths 

rddau 7 day mean dollars per day of auths on days with auths 

rddauall 7 day mean dollars per day of auths on all days in window 

rddcsapv 7 day mean dollars per day of cash approvals 

rddcsdec 7 day mean dolalrs per day of cash declines 

rdddec 7 day mean dollars per day of declines 

rdddec2 7 day mean dollars per day of declines on days with auths 

rddmrapv 7 day mean dollars per day of merchandise approvals 

rddmrdec 7 day mean dollars per day of merchandise declines 
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10 



15 



20 



45 



rdnapv 7 day mean number per day of approvals 

rdnau 7 day mean number per day of auths on days with auths 

rdnauatl 7 day mean number per day of auths on all days in window 

rdncsapv 7 day mean number per day of cash approvals 

rdncsdec 7 day mean number per day of cash declines 

rdndec 7 day mean number per day of declines 

rdnmrapv 7 day mean number per day of merchandise approvals 

rdnmrdec 7 day mean number per day of merchandise declines 

rdnsdap2 7 day mean number per day of approvals on same day of week calculated only for those days which had 
approvals 

rdnsdapv 7 day mean number per day of approvals on same day of week as current day 

rdnwdaft 7 day mean number per day of weekday afternoon approvals 

rdnwdapv 7 day mean number per day of weekday approvals 

rdnwdeve 7 day mean number per day of weekday evening approvals 

rdnwdmor 7 day mean number per day of weekday morning approvals 

rdnwdnit 7 day mean number per day of weekday night approvals 

rdnweaft 7 day mean number per day of weekend afternoon approvals 

rdnweapv 7 day mean number per day of weekend approvals 

rdnweeve 7 day mean number per day of weekend evening approvals 

rdnwemor 7 day mean number per day of weekend morning approvals 

rdnwenit 7 day mean number per day of weekend night approvals 

rhibal 7 day highest window balance 

rhidcapv 7 day highest dollar amt on a single cash approve 

rhidcdec 7 day highest dollar amt on a single cash decline 

rhidmapv 7 day highest dollar amt on a single merch approve 

rhidmdec 7 day highest dollar amt on a single merch decline 

rhidsapv 7 day highest dollar amount on a single approve 

rhidsau 7 day highest dollar amount on a single auth 

rhidsdec 7 day highest dollar amount on a single decline 

rhidtapv 7 day highest total dollar amount for an approve in a single day 

rhidtau 7 day highest total dollar amount for any auth in a single day 

rhidtdec 7 day highest total dollar amount for a decline in a single day 

rhinapv 7 day highest number of approves in a single day 

rhinau 7 day highest number of auths in a single day 

rhindec 7 day highest number of declines in a single day 

rnaudy 7 day number of days in window with any auths 

rnausd 7 day number of same day of week with any auths 

rnauwd 7 day number of weekday days in window with any auths 

rnauwe 7 day number of weekend days in window with any auths 

rncsandy 7 day number of days in window with cash auths 

rnmraudy 7 day number of days in window with merchant auths 

rtdapv 7 day total dollars of approvals 

rtdau 7 day total dollars of auths 

rtdcsapv 7 day total dollars of cash advance approvals 

rtdcsdec 7 day total dollars of cash advance declines 

rtddec 7 day total dollars of declines 

rtdmrapv 7 day total dollars of merchandise approvals 

rtdmrdec 7 day total dollars of merchandise declines 

rtnapv 7 day total number of approvals 

rtnapvdy 7 day total number of approves in a day 

rtnau 7 day total number of auths 

rtnaulOd 7 day number of auths in window <=$10 

rtncsapv 7 day total number of cash advance approvals 

rtncsdec 7 day total number of cash advance declines 

rtndec 7 day total number of declines 

rtnmrapv 7 day total number of merchandise approvals 

rtnmrdec 7 day total number of merchandise declines 

rtnsdapv 7 day total number of approvals on the same day of week as current day 
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rtnwdaft 7 day total number of weekday afternoon approvals 

rtnwdapv 7 day total number of weekday approvals 

rtnwdeve 7 day total number of weekday evening approvals 

rtnwdmor 7 day total number of weekday morning approvals 

rtnwdnit 7 day total number of weekday night approvals 

rtnweaft 7 day total number of weekend afternoon approvals 

rtnweapv 7 day total number of weekend approvals 

rtnweeve 7 day total number of weekend evening approvals 

rtnwemor 7 day total number of weekend morning approvals 

rtnwenit 7 day total number of weekend night approvals 

rvraudl 7 day variance of dollars per auth across window 

Profile Cardholder Fraud Related Variables 



15 



25 



paudymdy - 
pavapvdl - 
pavaudl - 
pchdzip - 
pdbm - 
pddapv - 
pddapv2 - 
pddau - 
pddau30 - 
pddcsapv - 
pddcsdec - 
pdddec - 
pdddec2 - 
pddmrapv - 
pddmrdec - 
pdnapv - 
pdnau - 
pdnau30 - 
pdncsapv - 
pdncsdec - 
pdndec - 
pdnmrapv - 
pdnmrdec - 
pdnw1ap2 - 
pdnwlapv - 
pdnw2ap2 - 
pdnw2apv - 
pdnw3ap2 - 
pdnw3apv - 
pdnw4ap2 - 
pdnw4apv - 
pdnw5ap2 - 
pdnwSapv - 
pdnw6ap2 - 
pdnw6apv - 
pdnw7ap2 - 
pdnw7apv - 
pdnwdaft - 
pdnwdapv - 
pdnwdeve - 
pdnwdmor - 
pdnwdnit - 
pdnweaft - 
pdnweapv - 



profile ratio of auth days over number of days in the month 
profile mean dollar amount for an approval 
profile mean dollars per auth across month 
profile the last zip of the cardholder 

profile value of 'date became member' at time of last profile update 



daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 


daily 


mean 



profile mean number of approvals on Sundays which had auths 
provilde mean number of approvals on Sundays (day 1 of week) 
profile mean number of approvals on Mondays which had auths 
profile mean number of approvals on Mondays (day 2 of week) 
profile mean number of approvals on Tuesdays which had auths 
profile mean number of approvals on Tuesdays (day 3 of week) 
profile mean number of approvals on Wednesdays which had auths 
profile mean number of approvals on Wednesdays (day 4 of week) 
profile mean number of approvals on Thursdays which had auths 
profile mean number of approvals on Thursdays (day 5 of week) 
profile mean number of approvals on Fridays which had auths 
profile mean number of approvals on Fridays (day 6 of week) 
profile mean number of approvals on Saturdays which had auths 
profile mean number of approvals on Saturdays (day 7 of week) 
profile daily mean number of weekday afternoon approvals 
profile daily mean number of weekday approvals 
profile daily mean number of weekday evening approvals 
profile daily mean number of weekday morning approvals 
profile daily mean number of weekday night approvals 
profile daily mean number of weekend afternoon approvals 
profile daily mean number of weekend approvals 
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10 



15 



20 



40 



50 



55 



pdnweeve - 
pdnwemor - 
pdnwenit - 
pexpir - 
phibal - 
phidcapv - 
phidcdec - 
phidmapv - 
phidmdec - 
phidsapv - 
phidsau - 
phidsdec - 
phidtapv - 
phidtau - 
phidtdec - 
phinapv - 
phinau - 
phindec - 
pmlavbal - 
pmlnauths - 
pm2avbal - 
pm2nauths - 
pm3avbal - 
pm3nauths - 
pmovewt - 

pnaudy - 
pnauwl - 
pnauw2 - 
pnauw3 - 
pnauw4 - 
pnauwS - 
pnauw6 - 
pnauw7 - 
pnauwd - 
pnauwe - 
pncsaudy - 
pnmraudy - 
pnweekday - 
pnweekend ■ 
pratdcau - 
prof age - 
psdaudy - 
psddau - 
ptdapv - 
ptdau - 
ptdaudy - 
ptdcsapv - 
ptdcsdec - 
ptddec - 
ptdmrapv - 
ptdmrdec - 
ptdsfaOl - 
ptdsfa02 - 
ptdsfa03 - 
ptdsfa04 - 
ptdsla05 - 
ptdsfa06 - 



profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 



calendar month; pmovew 



profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 
profi 



e daily mean number of weekend evening approvals 
e daily mean number of weekend morning approvals 
e daily mean number of weekend night approvals 
e expiry date stored in profile; update if curr date>pexpir 
e highest monthly balance 

e highest dollar amt on a single cash approve in a month 

e highest dollar amt on a single cash decline in a month 

e highest dollar amt on a single merch approve in a month 

e highest dollar amt on a single merch decline in a month 

e highest dollar amount on a single approve in a month 

e highest dollar amount on a single auth in a month 

e highest dollar amount on a single decline in a month 

e highest total dollar amount for an approve in a single day 

e highest total dollar amount for any auth in a single day 

e highest total dollar amount for a decline in a single day 

e highest number of approves in a single day 

e highest number of auths in a single day 

e highest number of declines in a single day 

e average bal. during 1st 10 days of mo. 

e number of auths in the 1st 10 days of mo. 

e average bal. during 2nd 10 days of mo. 

e number of auths in the 2nd 1 0 days of mo. 

e average bal. during remaining days 

e number of auths in the last part of the month. 

e uses last zip to determine recent residence move; pmovewt=2 for a move within the previous 



e number of days with auths 

e number of Sundays in month with any auths 

e number of Mondays in month with any auths 

e number of Tuesdays in month with any auths 

e number of Wednesdays in month with any auths 

e numberof Thursdays in month with any auths 

e number of Fridays in month with any auths 

e number of Saturdays in month with any auths 

e number of weekday days in month with any auths 

e number of weekend days in month with any auths 

e number of days in month with cash auths 

e number of days in month with merchant auths 

e number of weekday days in the month 

e number of weekend days in the month 

e ratio of declines to auths 

e number of months this account has had a profile (up to 6 mo.) 
e standard dev. of # days between transactions in a month 
e standard dev. of $ per auth in a month 



total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 


total 


dollars 


of 
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0 


ptdsfa07 - 


profile 


total 


dollars of transactions in SIC factor group 07 




ptdsfa08 - 


profile 


total 


dollars of transactions in SIC factor group 08 




ptdsfa09 - 


profile 


total 


dollars of transactions in SIC factor group 09 




ptdsfalO - 


profile 


total 


dollars of transactions in SIC factor group 10 


5 


ptdsfa11 - 


profile 


total 


dolalrs of transactions in SIC factor group 11 




ptdsraOl - 


profile 


total 


dollars of transactions in SIC fraud rate group 01 




ptdsra02 - 


profile 


total 


dollars of transactions in SIC fraud rate group 02 




ptdsra03 - 


profile 


total 


dollars of transactions in SIC fraud rate group 03 




ptdsra04 - 


profile 


total 


dollars of transactions in SIC fraud rate group 04 


10 


ptdsraOS - 


profile 


total 


dollars of transactions in SIC fraud rate group 05 




ptdsra06 - 


profile 


total 


dollars of transactions in SIC fraud rate group 06 




ptdsra07 - 


profile 


total 


dollars of transactions in SIC fraud rate group 07 




ptdsvaOl - 


profile 


total 


dollars in SIC VISA group 01 




ptdsva02 - 


profile 


total 


dollars in SIC VISA group 02 


15 


ptdsva03 - 


profile 


total 


dollars in SIC VISA group 03 




ptdsva04 - 


profile 


total 


dollars in SIC VISA group 04 




ptdsvaOS - 


profile 


total 


dollars in SIC VISA group 05 




ptdsva06 - 


profile 


total 


dollars in SIC VISA group 06 




ptdsva07 - 


profile 


total 


dollars in SIC VISA group 07 


20 


ptdsva08 - 


profile 


total 


dollars in SIC VISA group 08 




ptdsva09 - 


profile 


total 


dollars in SIC VISA group 09 




ptdsvalO - 


profile 


total 


dollars in SIC VISA group 10 




ptdsva11 - 


profile 


total 


dollars in SIC VISA group 11 




ptnapv - 


profile 


total 


number of approvals in a month 


25 


ptnapvdy - 


profile 


total 


number of approves a day 




ptnau - 


profile 


total 


number of auths in a month 




ptnaulOd - 


profile 


number of auths in month<=$10 




ptnaudy - 


profile 


total 


number of auths in a day 




ptncsapv - 


profile 


total 


number of cash advance approvals in a month 


30 


ptncsdec - 


profile 


total 


number of cash advance declines in a month 




ptndec - 


profile 


total 


number of declines in a month 




ptndecdy - 


profile 


total 


number of declines in a day 




ptnmrapv - 


profile 


total 


number of merchandise approvals in a month 




ptnmrdec - 


profile 


total 


number of merchandize declines in a month 


35 


ptnsfaOl - 


profile 


total 


number of transactions in SIC factor group 01 




ptnsfaOl - 


profile 


total 


number of transactions in SIC factor group 02 




ptnsfa03 - 


profile 


total 


number of transactions in SIC factor group 03 




ptnsfa04 - 


profile 


total 


number of transactions in SIC factor group 04 




ptnsfaOS - 


profile 


total 


number of transactions in SIC factor group 05 


40 


ptnsfa06 - 


profile 


total 


number of transactions in SIC factor group 06 




ptnsfa07 - 


profile 


total 


number of transactions in SIC factor group 07 




ptnsfa08 - 


profile 


total 


number of transactions in SIC factor group 08 




ptnsfa09 - 


profile 


total 


number of transactions in SIC factor group 09 




ptnsfalO - 


profile 


total 


number of transactions in SIC factor group 10 


45 


ptnsfa11 - 


profile 


total 


number of transactions in SIC factor group 11 




ptnsraOl - 


profile 


total 


number of transactions in SIC fraud rate group 01 




ptnsra02 - 


profile 


total 


number of transactions in SIC fraud rate group 02 




ptnsra03 - 


profile 


total 


number of transactions in SIC fraud rate group 03 




ptnsra04 - 


profile 


total 


number of transactions in SIC fraud rate group 04 


50 


ptnsraOS - 


profile 


total 


number of transactions in SIC fraud rate group 05 




ptnsra06 - 


profile 


total 


number of transactions in SIC fraud rate group 06 




ptnsra07 - 


profile 


total 


number of transactions in SIC fraud rate group 07 




ptnsvaOl - 


profile 


total 


number in SIC VISA group 01 




ptnsva02 - 


profile 


total 


number in SIC VISA group 02 


55 


ptnsva03 - 


profile 


total 


number in SIC VISA group 03 




ptnsva04 - 


profile 


total 


number in SIC VISA group 04 




ptnsvaOS - 


profile 


total 


number in SIC VISA group 05 




ptnsva06 - 


profile 


total 


number in SIC VISA group 06 
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ptnsva07 - profile total number in SIC VISA group 07 

ptnsva08 - profile total number in SIC VISA group 08 

ptnsva09 - profile total number in SIC VISA group 09 

ptnsvalO - profile total number in SIC VISA group 10 

ptnsval 1 - profile total number in SIC VISA group 11 

ptnwlap - profile total number of approvals on Sundays (day 1 of week) 

ptnw2apv - profile total number of approvals on Mondays (day 2 of week) 

ptnw3apv - profile total number of approvals on Tuesdays (day 3 of week) 

ptnw4apv - profile total number of approvals on Wednesdays (day 4 of week) 

ptnwSapv - profile total number of approvals on Thursdays (day 5 of week) 

ptnw6apv - profile total number of approvals on Fridays (day 6 of week) 

ptnw7apv - profile total number of approvals on Saturdays (day 7 of week) 

ptnwdaft - profile total number of weekday afternoon approvals in a month 

ptnwdapv - profile total number of weekday approvals in a month 

ptnwdeve - profile total number of weekday evening approvals in a month 

ptnwdmor - profile total number of weekday morning approvals in a month 

ptnwdnit - profile total number of weekday night approvals in a month 

ptnweaft - profile total number of weekend afternoon approvals in a month 

ptnweapv - profile total number of weekend approvals in a month 

ptnweeve - profile total number of weekend evening approvals in a month 

ptnwemor - profile total number of weekend morning approvals in a month 

ptnwenit - profile total number of weekend night approvals in a month 

pvdaybtwn - profile variance in number of days between trx's (min of 3 trx) 

pvraudl - profile variance of dollars per auth across month 

MERCHANT FRAUD VARIABLES 



mtotturn 

msicturn 

mctrtage 

maagsic 

mavgnbtc 

maamttrx 

mvaramt 

mavgtbtc 

mavgtaut 

mratks 

mnidclac 

mnidcham 

mtrxsrc 

mtrxtrsp 

mfloor 

mchgbks 

mrtrvs 

macqrat 



mprevrsk 
mtyprsk 
msicrat 
50 mpctaut 



40 



Merchant Total turnover for this specific merchant 
Merchant Cumulative SIC code turnover 
Merchant Contract age for specific merchant 
Merchant Average contract age for this SIC code 
Merchant Average number of transactions in a batch 

Merchant Average amount per transaction (average amount per authorization) 
Merchant Variance of amount per transaction 
Merchant Average time between batches 

Merchant Average time between authorizations for this merchant 

Merchant Ratio of keyed versus swiped transactions 

Merchant Number of identical customer accounts 

Merchant Number of identical charge amounts 

Merchant What is the source of transaction (ATM, merchant, etc.) 

Merchant How is the transaction transported to the source (terminal, non-terminal, voice authorization) 

Merchant Floor limit 

Merchant Charge-backs received 

Merchant Retrievals received (per SIC, merchant, etc.). The issuer pays for a retrieval. 

Merchant Acquirer risk management rate (in Europe one merchant can have multiple acquirers, but they 

dont have records about how many or who.) 

Merchant Previous risk management at this merchant? Yes or No 

Merchant Type of previous risk management (counterfeit, multiple imprint, lost/stolen/not received) 
Merchant SIC risk management rate 
Merchant Percent of transactions authorized 



Network Training : Once pre-processing is complete, the fraud-related variables are fed to the network and the 
network is trained. The preferred embodiment uses a modeling technique known as a "feed forward" neural network. 
This type of network estimates parameters which define relationships among variables using a training method. The 
55 preferred training method, well known to those skilled in the art, is called "backpropagation gradient descent optimi- 
zation", although other well-known neural network training techniques may also be used. 

One problem with neural networks built with conventional backpropagation methods is insufficient generalizability. 
Generalizability is a measure of the predictive value of a neural network. The attempt to maximize generalizability can 
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be interpreted as choosing a network model with enough complexity so as not to underfit the data but not too much 
complexity so as to overfit the data. One measure of the complexity of a network is the number of hidden processing 
elements, so that the effort to maximize gene ratability translates into a selection among models having different 
numbers of hidden processing elements. Unfortunately, it is often not possible to obtain all the nonlinearity required 

5 for a problem by adding hidden processing elements without introducing excess complexity. Many weights that come 
with the addition of each new hidden processing element may not be required or even helpful for the modeling task at 
hand. These excess weights tend to make the network fit the idiosyncrasies or "noise" of the data and thus fail to 
generalize well to new cases. This problem, known as overfitting, typically arises because of an excess of weights. 
Weight decay is a method of developing a neural network that minimizes overfitting without sacrificing the predictive 

10 power of the model. This method initially provides the network with all the nonlinearity it needs by providing a large 
number of hidden processing elements. Subsequently, it decays all the weights to varying degrees so that only the 
weights that are necessary for the approximation task remain. Two central premises are employed: t ) when given two 
models of equivalent performance on a training data set, favor the smaller model; and 2) implement a cost function 
that penalizes complexity as part of the backpropagation algorithm. The network is trained by minimizing this cost 

is function. Complexity is only justified as it expresses information contained in the data. A weight set that embodies all 
or almost all of the information in the data and none of the noise will maximize generalizability and performance. 

The cost function is constructed by introducing a "decay term" to the usual error function used to train the network. 
It is designed to optimize the mode! so that the network captures all the important information in the training set, but 
does not adapt to noise or random characteristics of the training set. In view of these requirements, the cost function 

20 must take into account not only prediction error, but also the significance of model weights. A combination of these 
two terms yields an objective function which, when minimized, generalizes optimally. Performing a conventional gra- 
dient descent with this objective function optimizes the model. 

In introducing the decay term, an assumption is made about what constitutes information. The goal is to choose 
a decay term that accurately hypothesizes the prior distribution of the weights. In finding a good prior distribution, one 

25 examines the likelihood that the weights will have a given distribution without knowledge of the data. 

Weigend et al, "Generalization by Weight-Elimination with Application to Forecasting", in Advances in Neural In- 
formation Processing Systems 3 , pp. 875-82, and incorporated herein by reference, discloses the following cost function 
for weight decay: 

30 

-^(target, -output k ) 2 +X£ ^ 

35 

where: 

D is the data set; 

target k is the target, or desired, value for element k of the data set; 
^0 output k is the network output for element k of the data set; 

/ represents the relative importance of the complexity term; 
W is the weight set; 
Wj is the value of weight /, and 
w Q is a constant that controls the shape of the curve that penalizes the weights. 

45 

The first term of the Weigend function measures the performance of the network, while the second term measures 
the complexity of the network in terms of its size. With this cost f unction, small weights decay rapidly, while large weights 
decay slowly or not at all. 

A major failing of the Weigend cost function, and similar weight decay schemes, is that they do not accurately 
so mimic the intended prior distribution. Finding a good prior distribution (or "prior") is a key element to developing an 
effective model. Most of the priors in the literature are sufficient to demonstrate the concept of weight decay but lack 
the strengths required to accommodate a wide range of problems. This occurs because the priors tend to decay weights 
evenly for a given processing element, without sufficiently distinguishing important weights (which contain more infor- 
mation) from unimportant weights (which contain less information). This often results either in 1) undesired decaying 
55 of important weights, which diminishes the power of the system to accommodate nonlinearity, or 2) undesired retention 
of excess unimportant weights, which leads to overfitting. 

The present invention uses the following improved cost function, which addresses the above problems: 



(Eq. 1) 
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^^L< target k -output,) 2 + $/5^c,w i 2 - \ ) (Eq. 2) 

\ 

5 

where g represents a new term known as the interlayer gain multiplier for the decay rate, and c 1 is a constant. The 
interlayer gain multiplier takes into account the relative proximity of the weights to the input and output ends of the 
network. Thus, the interlayer gain multiplier allows application of the decay term with greater potency to elements that 
are closer to the inputs, where the majority of the weights typically reside, while avoiding excessive decay on weights 

io corresponding to elements closer to the outputs, which are more critical, since their elimination can effectively sever 
large numbers of input-side weights. 

By intensifying decay on input-side elements, the cost function of Equation 2 improves the ability of model devel- 
opment component 801 to decay individual weights while preserving processing elements containing valuable infor- 
mation. The result is that weak interactions are eliminated while valid interactions are retained. By retaining as many 

is processing elements as possible, the model does not lose the power to model nonlinearittes, yet the overfitting problem 
is reduced because unnecessary individual weights are removed. 

Once the cost function has been iteratively applied to the network, weights that have been decayed to a very small 
number (defined as e) are removed from the network. This step, known as "thresholding the net" is performed because 
it is often difficult to completely decay weights to zero. 

20 Once the network has been trained using past data, the network's model definition is stored in data files. One 

portion of this definition, called the "CFG" file, specifies the parameters for the network's input variables, including such 
information as, for example, the lengths of the variables, their types, and their ranges. Referring now to Figure 21, 
there is shown a portion of a typical CFG file, specifying parameters for an ACCOUNT variable 2101 (representing a 
customer account number) and a PAUDYMDY variable 2102 (a profile variable representing the ratio of transaction 

25 days divided by the number of days in the month). The file formats used to store the other model definition files for the 
network are shown below. 



A 



ASCII File Formats 

40 

The ASCII network data files (.eta, .sta, lea, 
(space, tab, newline). 

Whitespace is ignored except to separate tokens 
irrelevant. 

45 File format notation is as follows: 

* Bracketed text denotes a token. 

* Nonbracketed text denotes a literal token which must be matched exactly, including case. 

* Comments on the right are not part of the file format; they simply provide further description of the format. 

so * in the comments, vertical lines denote a block which can be repeated. Nested vertical lines denote repeatable 
sub-blocks. 

. eta Format 



File format 


Comments 


cts 





.wta) consist of tokens (non -whitespace) separated by whitespace 
. Use of line breaks and tabs is encouraged for clarity, but otherwise 
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(continued) 



File format 


Comments 


<NetName> 
<Value> 


I Repeated as needed 



cts and <NetName> must appear first. <NetName> is the standard abbreviation, lowercase (e.g., mbpn). The <Value>s 
are the network constants values, in the order defined within the constants structure. If a constants value is an array 
or structured type, each element or field must be a separate token, appearing in the proper order. 



Example 


Comments 


cts 




mbpn 




2 


I nnut5^i7fi 

ii ipuivu.o 


1 


OutoutSi7P 


1 


cHidSlabs 


2 


HiddenSize[0] 


0 


HiddenSize[1] 


0 


HiddenSize[2] 


3 


RandomSeed 


1.0 


InitWeightMax 


0 


WtsUpdateFlag 


0 


Connectlnputs 


0 


FnClass 


1.0 


Parml 


1.0 


Parm2 


-1.0 


Parm3 


0.0 


Parm4 


0.0 


Parm5 


1 


cEntTbl 


0.0 


xLow 


0.1 


xHigh 


0.2 


HiddenAlpha[0] 


0.0 


Hidden Alpha[l] 



Example 


Comments 


0.0 


HiddenAlpha[2] 


0.1 


OutputAIpha 


0.9 


Hidden Beta[0] 


0.0 


HiddenBeta[1] 


0.0 


Hidden Beta[2] 


0.9 


Output Beta 


0.0 


Tolerance 


0 


WtsUpdateFlag 


0 


BatchSize 


0 


LinearOutput 


0 


ActTblFlag 


1 


StatsFlag 


1 


LearnFlag 



In this example, HiddenSize, HiddenAlpha, and HiddenBeta are all arrays, so each element (0, 1 , 2) has a separate 
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token, in the order they appear in the type. 
.sta Format 



10 



15 



20 



File format 


Comments 


sts 

<NetName> 

<cSlab> 

<nSlab> 

<cPe> 

<state> 


I Repeated cSlab times 
I 

I I Repeated cPe times 



sts and <NetName> must appear first. <NetName>is the standard abbreviation, lowercase. <cSlab> a count of the 
slabs which have states stored in the file. The remainder of the file consists of cSlab blocks, each describing the states 
of one slab. The order of the slab blocks in the file is not important. <nSlab> is the slab number, as defined in the xxx. 
h file. cPe is the number of states for the slab. <state> is the value of a single state. If the state type is an array or 
structured type, each element or field must be a separate token, appearing in the proper order. There should be cPe 
<state> values in the slab block. 



30 



Example 


Comments 


sts 




mbpn 




6 


cSlab 


0 


nSlab -- SlablnMbpn 


2 


cPeln 


0.0 


Stsln[0] 


0.0 


Stsln[1j 


1 


nSlab -- SlabTrnMbpn 


1 


cPeTrn 


0.0 


StsTrn[0] 


2 


nSlab « SlabHidOMbpn 


2 


cPeHidO 


0.0 


StsHid0[0] 


0.0 


StsHid0[1] 


5 


nSlab -- SlabOutMbpn 


1 


cPeOut 


0.0 


StsOut[0] 


6 


nSlab - SlabBiasMbpn 


1 


cPeBias 


1.0 


StsBias[0] 


7 


nSlab -- SlabStatMbpn 


3 


cPeStat 


0.0 


StsStat[0] 


0.0 


StsStat[1] 


0.0 


StsStat[2] 



. lea Format 



55 



File format 


Comments 


Icl 
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(continued) 



File format 


Comments 


<NetName> 

<cSlab> 

<nSlat» 

<cPe> 

<local> 


I Repeated cSlab times 
1 

II Repeated cPe times 



The lea format is just tike the .sta format except that sts is replaced by Id. Id and <NetName> must appear first. 
<NetName> is the standard abbreviation, lowercase. <cSlab> a count of the slabs which have local data stored in the 
file. The remainder of the file consists of cSlab blocks, each describing the local data values of one slab. <nSlab> the 
slab number, as defined in the xxx.Mile. The order of the slab blocks in the file is not important. cPe is the number of 
is local data values for the slab. <local> is the value of a single local data element. If the local data type is an array or 
structured type, each element or field must be a separate token, appearing in the proper order. There should be cPe 
<local> values in the slab block. 



Example 


Comments 


Id 




mbpn 




3 


cSlab 


2 


nSlab - SlabHidOMbpn 


2 


cPe 


0.0 


LclHid0[0].Error 


0.0 


LclHidO[0].Netlnp 


0.0 


LclHid0[1].Error 


0.0 


LclHid0[1].Netlnp 


5 


nSlab - SlabOutMbpn 


t 


cPe 


0.0 


LclOut[0]. Error 


0.0 


LclOut[0].Netlnp 


7 


nSlab -- SlabStatMbpn 


3 


cPe 


0 


LclStat[0].clter 


0.0 


LclStat[0].Sum 


0 


LclStat[1].clter 


0.0 


LclStat[1].Sum 


0 


LclStat[2].clter 


0.0 


LclStat[2].Sum 



In this example, the <local> values are all structured types, so each field (Error and Netlnp; clter and Sum) has a 
separate token, in the order they appear in the type. 

. wta Format 



55 



File format 


Comments 


wis 

<NetName> 

<cClass> 

<nSlab> 

<nClass> 

<clcn> 


1 Repeated cClass times 

1 

1 
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(continued) 



File format 


Comments 


<weight> 


I I Repeated clcn times 



wts and <NetName> must appear first. <NetName> is the standard abbreviation, lowercase. <cClass> is a count of 
the slab/class combinations which have weights stored in the file. The remainder of the file consists of cClass blocks, 
each describing the weights of one slab. The order of the class blocks in the file is not important. <nSlab> is the slab 
number, as defined in the xxx.hftle. <nClass> is the class number, as defined in the xxx.Mile. <weight> is the value 
of a single weight. If the weight type is an array or structured type, each element or field must be a separate token, 
appearing in the proper order. There should be clcn <weight> values in the slab block. 



Example 


Comments 


wts 




mbpn 




2 


cClass 


2 


nSlab -- SlabHidOMbpn 


0 


nClass PeHidO Mbpn FromP rev 


6 


clcn 


0.0 


WtsHid0[PE„0][0] 


0.0 


WtsHid0[PE_0][1] 


0.0 


WtsHid0[PE_0][2] 


0.0 


WtsHid0[PE_1][0] 


0.0 


WtsHid0[PE_1][1] 


0.0 


WtsHid0[PE_1][2] 


5 


nSlab - SlabOutMbpn 


0 


nClass — PeOut Mbpn FromP rev 


3 


clcn 


0.0 


WtsOut[PE_0][0] 



Example 


Comments 


0.0 
0.0 


WtsOut[PE_0][1] 
WtsOut[PE_0][2] 



Weights values for a slab and class are stored as a one-dimensional array, but conceptually are indexed by two values 
- PE and interconnect within PE. The values are stored in row-major order, as exemplified here. 

Transaction Processing Component 802 

Once the model has been created, trained, and stored, fraud detection may begin. Transaction processing com- 
ponent 802 of system 100 preferably runs within the context of a conventional authorization or posting system for 
customer transactions. Transaction processing component 802 reads current transaction data and customer data from 
databases 805, 806, and generates as output fraud scores representing the likelihood of fraud for each transaction. 
Furthermore, transaction processing component 802 can compare the likelihood of fraud with a predetermined thresh- 
old value, and flag transactions for which the threshold is exceeded. 

The current transaction data from database 805 typically includes information such as: transaction dollar amount; 
date; time (and time zone if necessary); approve/decline code; cash/merchandise code; available credit (or balance); 
credit line; merchant category code; merchant ZIP code; and PIN verification (if applicable). 

The customer data from database 806 typically includes information from three sources: 1) general information 
on the customer; 2) data on all approved or declined transactions in the previous seven days; and 3) a profile record 
which contains data describing the customer's transactional pattern over the last six months. The general information 
on the customer typically includes information such as: customer ZIP code; account open date; and expiration date. 
The profile record is a single record in a profile database summarizing the customer's transactional pattern in terms of 
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moving averages. The profile record is updated periodically (usually monthly) with all of the transactions from the period 
for the customer, as described below. 

System 100 can operate as either a batch, semi-real-time, or real-time system. The structure and processing flow 
of each of these variations will now be described. 

s Batch System : Figure 14 shows operation of a batch system. Transactions are recorded throughout the day or 

other convenient period 1402. At the end of the day, the system performs steps 1403 to 1409 for each transaction. It 
obtains data describing the current transaction 1403, as well as past transaction data, customer data, and profile data 
1404. It then applies this data to the neural network 1405 and obtains a fraud score 1406. If the fraud score exceeds 
a threshold 1407, the account is flagged 1408. In the batch system, therefore, the transaction which yielded the high 

10 fraud score cannot itself be blocked; rather, the account is flagged 1404 at the end of the day so that no future trans- 
actions are possible. Although the batch system does not permit immediate detection of fraudulent transactions, re- 
sponse-time constraints may mandate use of the batch system in some implementations. 

Semi-Real-Time System : The semi-real-time system operates in a similar manner to the batch system and uses 
the same data files, but it ensures that no more than one high-scoring transaction is authorized before flagging the 

*5 account. In this system, as shown in Figure 15, fraud likelihood determination is performed (steps 1504 to 1509) im- 
mediately after the transaction is authorized 1503. Steps 1504 to 1509 correspond to steps 1403 to 1409 of the batch 
system illustrated in Figure 1 4. If the likelihood of fraud is high, the account is flagged 1 509 so that no future transactions 
are possible. Thus, as in the batch system, the current trans-action cannot be blocked; however, the semi-real-time 
system allows subsequent transactions to be blocked. 

20 Real-Time System : The real-time system performs fraud likelihood determination before a transaction is author- 

ized. Because of response-time constraints, it is preferable to minimize the number of database access calls when 
using the real-time system. Thus, in this embodiment, all of the customer information, including general information 
and past transaction data, is found in a single record of profile database 806. Profile database 806 is generated from 
past transaction and customer data before the transaction processing component starts operating, and is updated after 

25 each transaction, as described below. Because all needed data are located in one place, the system is able to retrieve 
the data more quickly than in the batch or semi-real-time schemes. In order to keep the profile database 806 current, 
profile records are updated, using moving averages where applicable, after each transaction. 

Referring now to Figure 16, there is shown a flowchart of a real-time system using the profile database. Upon 
receiving a merchant's request for authorization on a transaction 1 602, the system obtains data for the current trans- 

30 action 1 603, as well as profile data summarizing transactional patterns for the customer 1 604. It then applies this data 
to the stored neural network model 1605. A fraud score (representing the likelihood of fraud for the transaction) is 
obtained 1606 and compared to a threshold value 1607. Steps 1601 through 1607 occur before a transaction is au- 
thorized, so that the fraud score can be sent to an authorization system 1608 and the transaction blocked by the 
authorization system if the threshold has been exceeded. If the threshold is not exceeded, the low fraud score is sent 

35 to the authorization system 1609. The system then updates customer profile database 806 with the new transaction 
data 1610. Thus, in this system, profile database 806 is always up to date (unlike the batch and semi-real-time systems, 
in which profile database 806 is updated only periodically). 

Referring now to Figure 1 2, there is shown the method of creating a profile record. The system performs the steps 
of this method when there is no existing profile record for the customer. The system reads the past transaction database 

40 1101 for the past six months and the customer database 1103 (steps 1202 and 1203 respectively). It generates a new 
profile record 1204 with the obtained data and saves it in the profile database 1205. If there are more accounts to be 
processed 1206, it repeats steps 1202 through 1205. 

Referring now to Figure 1 3, there is shown the method of updating an existing profile record. The system reads 
the past transaction database 1 1 01 for the past six months, customer database 1 1 03 and profile database (steps 1 302, 

45 1303, and 1 304 respectively). It combines the data into a single value for each variable in the profile database. This 
value is generated using one of two formulas. 

For variables that represent average values over a period of time (for example, mean dollars of transactions in a 
month), Equation 3 is used: 

so 

newProfData = ((1 - a) * oldProfData) + (a * currentVal)) (Eq. 3) 

For variables that represent extreme values over a period of time (for example, highest monthly balance), Equation 
4 is used: 

55 

newProfData = max(currentVal, b * oldProfData) (Eq. 4) 
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In Equations 3 and 4: 



newProfData is the new value for the profile variable; 
oldProfData is the old value for the profile variable; 
5 current Val is the most recent value of the variable, from the past transaction database; and 

a and b are decay factors which are used to give more importance to recent months and less importance to months 
further in the past. 

The value of b is set so that older data will "decay" at an acceptable rate. A typical value for b is 0.95. 
10 The value of a is generated as follows: For the batch and semi-real-time systems, a is set to a value such that the 

contribution of the value from more than six months previous is nearly zero. For profiles that have been in existence 
for at least six months, the value of a is 1/6. For newer profiles, the value is 1/(n+1), where n is the number of months 
since the profile was created. For the real-time system, profile updates do not occur at regular intervals. Therefore, a 
is determined using the following equation: 

15 

a = 1 - exp (-t/T) (Eq. 5) 



where: 

20 

t is the time between the current transaction and the last transaction; and 
T is a time constant for the specific variable. 



Furthermore, for the real-time system, currentVal represents the value of the variable estimated solely using in- 
25 formation related to the current transaction and the time since the last transaction, without reference to any other 
historical information. 

Once the new values for the profile variables have been generated, they are placed in an updated profile record 
1305 and saved in the profile database 1306. If there are more accounts to be processed 1307, the system repeats 
steps 1302 through 1306. 

30 in ail of these embodiments, the current transaction data and the customer data are preferably pre-processed to 

derive fraud-related variables which have been empirically determined to be effective predictors of fraud. This is done 
using the same technique and the same fraud-related variables as described above in connection with neural network 
training. 

Referring now to Figures 17 through 19, there are shown flowcharts illustrating the operation of the preferred 
35 embodiment of the transaction processing component. Some of the individual elements of the flowchart are indicated 

by designations which correspond to module names. 

Referring now to Figure 17, there is shown the overall operation of transaction processing component 802. First 

the system runs module CINITNET 1702, which initializes network structures. Then, it runs module CSCORE 1703. 

Module CSCORE 1703 uses current trans-action data, data describing transactions over the past seven days, a profile 
40 record, and customer data to generate a fraud score indicating the likelihood that the current transaction is fraudulent, 

as well as reason codes (described below). The system then checks to see whether there are more transactions to be 

processed 1704, and repeats module CSCORE 1703 for any additional transactions. When there are no more to be 

processed, the system runs module FREE NET 1705, which frees the network structures to allow them to be used for 

further processing. 

45 Referring now to Figure 18, there is shown the operation of module CSCORE 1703. First, module CSCORE 1703 

obtains current transaction data, data describing transactions of the past seven days, the profile record, and customer 
data (steps 1802 through 1805). From these data, module CSCORE 1703 generates the fraud-related variables 1806 
described above. Then, it runs module DeployNet 1807, which applies the fraud-related variables to the stored neural 
network and provides a fraud score and reason codes. CSCORE then outputs the score and reason codes 1808. 

so Referring now to Figure 1 9, there is shown the operation of module DeployNet 1 807. Module DeployNet 1 807 first 

scales the fraud-related variables 1902 to match the scaling previously performed in model development. If the value 
of a variable is missing, DeployNet sets the value to equal the mean value found in the training set. Then it applies the 
scaled variables to the input layer of neural network 108, in step 1903. In step 1904, it processes the applied data 
through the network to generate the fraud score. The method of iterating the network is well known in the art. 

55 in addition to providing fraud scores, in step 1904, module DeployNet 1807 optionally generates "reason codes". 

These codes indicate which inputs to the model are most important in determining the fraud score for a given trans- 
action. Any technique that can track such reasons may be used. 

The following module descriptions summarize the functions performed by the individual modules. 
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FALCON C FILES 


5 


FILE NAME 
DESCRIPTION 


1 CINITNET 

J \— / 1 1 111 1 It! U_ 1 

; Contains code to allocate and initialize the network structures. 




FUNCTION NAME 
DESCRIPTION 


■ CINITNET() 

| Allocate and initialize the network structures. 


10 


FILE NAME 
DESCRIPTION 


| CSCORE 

j Generates fraud related variables and iterates the neural network. 

: 


15 


FUNCTION NAMF 
DESCRIPTION 


! Creates fraud related variables from raw variables and makes calls to initialize the 
j input layer and iterate the neural network. 




FUNCTION NAME 
DESCRIPTION 


i setlnput() 

j Sets the input value for a processing element in the input layer. 


20 


FUNCTION NAME 
DESCRIPTION 


| hiReason() 

1 Finds the three highest reasons for the score. 


25 


FILE NAME 
DESCRIPTION 


j CFREENET 

I Makes function calls to free the network structures. 


FUNCTION NAME 
DESCRIPTION 


; CFREENET() 

i Frees the network structures. 


30 


FILE NAME 
DESCRIPTION 


! CCREATEP 

1 Contains the cardholder profile creation code. 


35 


FUNCTION NAME 
DESCRIPTION 


| createpf() 

j Creates a profile record for a cardholder using the previous month's authorizations 
| and cardholder data. 


FILE NAME 
DbbCHIP 1 ION 


| CUPDATEP 

j Updates a profile of individual cardholder activity. 


40 


FUNCTION NAME 
UbbGHIP 1 ION 


j 

j updatepf() 

j Updates a profile record for a cardholder using the previous profile record values as 
! well as the previous month's authorizations and cardholder data. 


45 


FILE NAME 
DESCRIPTION 


j CCOMMON 

i 

; This file contains functions which are needed by at least two of the following: createpf 
j (), updatepf(), score(). 




FUNCTION NAME 
DESCRIPTION 


: 

{ accumMiscCnts() 

j Increments counters of various types for each authorization found. 

j 


SO 


FUNCTION NAME 
DESCRIPTION 


1 accumSicCnts() 

j Increments SIC variable counters. 

: 


55 


FUNCTION NAME 
DESCRIPTION 


! 

; initStcCounts() 

j Initializes the SIC variable counters. 




FUNCTION NAME 


: 
: 

j updateSicMovAvgs() 
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(continued) 


FALCON C FILES 


DESCRIPTION 


Updates the SIC profile variables. 


FUNCTION NAME 
DESCRIPTION 
FUNCTION NAME 
DESCRIPTION 


writeMiscToProfile() 

Writes various variables to the profile record after they have been calculated. 
hncDate() 

Converts a Julian date to a date indicating the number of days since Jan. 1 , 1990. 


FUNCTION NAME 
DESCRIPTION 


missStr() 

Checks for "missing" flag (a period) in a null terminated string. String must have only 
blanks and a period to qualify as missing. A string with only blanks will also qualify 
as "missing". 


Cascaded Operation 



20 



40 



45 



One way to improve system performance is via "cascaded" operation. In cascaded operation, more than one neural 
network model is used. The second neural network model is trained by model development component 801 in a similar 
manner to that described earlier. However, in training the second model, model development component 801 uses 
only those transactions that have fraud scores, as determined by prior application to the first neural network model, 
above a predetermined cascade threshold. Thus, the second model provides more accurate scores for high-scoring 
transactions. While the same fraud-related variables are available to train both models, it is often the case that different 
variables are found to be significant in the two models. 

Referring now to Figure 20, there is shown a flowchart of the operation of the transaction processing component 
in a cascaded system. First, transaction processing component 802 scores each transaction using the first model 2002, 
as described above. Those transactions that score above the cascade threshold 2003 are applied to the second neural 
network model 2005. The system outputs scores and reason codes from either the first model 2004 or the second 
model 2006, as appropriate. 

The above-described cascading technique may be extended to include three or more neural network models, each 
having a corresponding cascade threshold. 

Performance Monitor 

The system periodically monitors its performance by measuring a performance metric comprising the fraud detec- 
tion rate and the false positive rate. Other factors and statistics may also be incorporated into the performance metric. 
When the performance metric falls below a predetermined performance level, the system may either inform the user 
that the fraud model needs to be redeveloped, or it may proceed with model redevelopment automatically. 

From the above description, it will be apparent that the invention disclosed herein provides a novel and advanta- 
geous method of detecting fraudulent use of customer accounts and account numbers, which achieves high detection 
rates while keeping false positive rates relatively low. The foregoing discussion discloses and describes merely exem- 
plary methods and embodiments of the present invention. As will be understood by those familiar with the art, the 
invention may be embodied in many other specific forms. Other variables might be used in both the model development 
and transaction processing components. 

Accordingly, the disclosure of the present invention is intended to be illustrative of the preferred embodiments and 
is not meant to limit the scope of the invention. The scope of the invention is to be limited only by the following claims. 

Claims 

1. A computer-implemented process for identifying and determining fraudulent transaction data in a computer-con- 
trolled transaction processing system (100) including predictive modeling means (108) for receiving current trans- 
action data (805), processing the current transaction data, and outputting a plurality of output values (1005, 807), 
including a score value representing a likelihood of a fraudulent transaction, comprising the steps of: 
prior to receiveng the current transaction data (805) for at least one current transaction: 
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generating a consumer profile for each of a plurality of consumers from a plurality of past fraud-related variables 
(1123) and from consumer data (800), each consumer profile describing historical spending patterns of a 
corresponding consumer; the past fraud-related variables (1123) being derived by pre-processing past trans- 
action data (804), the past transaction data including values for a plurality of transaction variables for a plurality 
of past transactions, the consumer data (806) including values for each consumer for a plurality of consumer 
variables; 

training the predictive modeling means (108) with the consumer profiles and with the past fraud-related vari- 
ables to obtain a predictive model; and 
storing the obtained predictive model in the computer; 

receiving current transaction data (805) for a current transaction of a consumer, 
receiving consumer data (806) associated with the consumer; 
receiving the consumer profile associated with the consumer; 

pre-processing the obtained current transaction data (805), consumer data (806), and consumer profile to 
derive current fraud-related variables for the current transaction; 

determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to 
the predictive model; and 

outputting from the predictive modeling means (1 08) an output signal (1 005, 807) indicating the likelihood that 
the current transaction is fraudulent. 

The process of claim 1 , wherein the generating step comprises the substeps of: 

receiving past transaction data (804) for a plurality of past transactions, the past transaction data providing 
values for a plurality of transaction variables; 

receiving consumer data (806) for each of a plurality of consumers, the consumer data providing values for a 
plurality of consumer variables for each consumer; 

pre-processing the past transaction data (804) to derive past fraud-related variables (1123) wherein at least 
some of the past fraud-related variables are not present in the plurality of variables in the past transaction 
data (804). 

The process of claim 1 or 2, further comprising the step of updating the received consumer profile with the received 
current transaction data (805). 

The process of one of the preceding claims, wherein the step of training the predictive modeling means comprises 
the substeps of: 

applying the consumer profile and the derived past fraud-related variables to the predictive modeling means 
(108); ranking output data from the predictive modeling means as a function of a quality measurement; 
adjusting the predictive modeling means as a function of the ranking step; and 

repeating the applying, ranking, and adjusting steps until the quality measurement exceeds a predetermined 
level indicating that the predictive modeling means is adequately trained. 

The process of one of the proceding claims, wherein the step of training the predictive modeling means comprises 
training a neural network (108) organized as a plurality of input processing elements (1001) for receiving the plu- 
rality of data values in the transaction data, a plurality of hidden processing elements (1003) coupled to the input 
processing elements (1001) for processing the transaction data, and a plurality of output processing elements 
(1 004) coupled to the hidden processing elements (1 003) for outputting the plurality of output values (1 005, 807). 

The process of claim 5, wherein the neural network (108) comprises a plurality of processing elements linked by 
connections characterized by weights, and the step of adjusting the neural network comprises the steps of: 

selecting a subset of the weights to be decayed; and 
decaying the selected subset of weights. 

The process of one of the preceding claims, wherein the current transaction data (805), the consumer profile, and 
the consumer data (806) each comprise a plurality of data elements, further comprising, for at least one of the 
data elements the steps of: 
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determining a relative contribution value of the data element to the output signal indicating the likelihood that 
the current transaction is fraudulent; 

determining a reason code which indicates a reason for the output signal as a function of the relative contri- 
bution value; 

retrieving an explanation associated with the determined reason code value; and 
outputting a computer signal indicative of the reason code and the explanation. 

. The process of one of the preceding claims further comprising the steps of: 

monitoring a performance metric of the predictive modeling means (108), the performance metric comprising 
at least one of a fraud detection rate measurement and a false positive rate measurement; 
comparing the performance metric with a predetermined performance level for the performance metric; and 
in response to the predetermined performance level exceeding the performance metric, repeating the step of 
training the predictive modeling means (108). 

. The process of one of the preceding claims, wherein the past fraud-related variables (11 23) and the current fraud- 
related variables each comprise at least: 

transaction dollar amounts of past transactions; 
transaction dates and times of past transactions; 

transaction approvals and declines of past transactions; risk groups of past transactions; and 
merchants of past transactions. 

0. The process of claim 1, wherein the step of training the predictive modeling means comprises training a neural 
network (108) in the computer-controlled transaction processing system (100), said system (100) comprising: 

a computer-readable memory (102); and 

the neural network (108) comprising a plurality of interconnected processing elements (1002, 1003, 1004), 
each processing element being in a layer of the neural network, each layer having a distance to an input layer, 
each processing element comprising: 

a plurality of inputs (x); 

a plurality of weights (w), each weight (w) associated with a corresponding input (x) to form weighted inputs; 

a summation function (902) for combining the weighted inputs; and 

a transfer function (903) for processing the combined weighted inputs into an output (z); 

characterized by the steps of: 

iteratively decaying the weights of at least one processing element by a cost function that varies a decay rate for 
decaying the weights by a function of the distance of the input layer from the layer containing the processing 
element. 

1. The process of claim 10, wherein the cost function is of the form: 



D represents a data set; 

target k represents a target value for an element k of the data set; 
output k represents a neural network output for element k of the data set; 

g represents an interlayer gain multiplier that varies as a function of the distance between the input layer and 

the layer containing the processing element; 

X represents the relative importance of the decay rate term; 

W represents a weight set; 




wherein: 
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(0-, represents a value of weight i; and 
Cj represents a constant. 

1 2. A computer-controlled transaction processing system ( 1 00) including predictive modeling means ( 1 08) for receiving 
s current transaction data (805), processing the current transaction data, and outputting a plurality of output values 

(1005, 807), including a score value representing a likelihood of a fraudulent transaction, including a model devel- 
opment component for developing a predictive model, comprising: 

means for receiving past transaction data (804) for a plurality of past transactions, the past transaction data 
to providing values for a plurality of transaction variables; 

means for receiving consumer data (806) for each of a plurality of consumers, the consumer data providing 
values for a plurality of consumer variables for each consumer; 

means for pre-processing the past transaction data (804) to derive past fraud-related variables ( 1 1 23) wherein 
at least some of the past fraud-related variables are not present in the plurality of variables in the past trans- 
is action data (804); 

means for generating a consumer profile for each individual consumer, from the past fraud-related variables 
(1123) and the received consumer data (806), the consumer profile describing historical spending patterns of 
the consumer; 

means for training the predictive model with the consumer profiles and with the past fraud-related variables; and 
20 - means for storing the trained predictive model in the computer; and 

a model application component, for applying the trained predictive model, comprising: 

means for receiving current transaction data (805) for a transaction of a consumer; 
25 - means for receiving consumer data (806) associated with the consumer; 

means for receiving the consumer profile asociated with the consumer; 

a current transaction data pre-processor, for pre-processing the obtained current transaction data (805), con- 
sumer data (806), and consumer profile to derive current fraud-related variables for the current transaction; 
means for determining the likelihood ot fraud in the current transaction by applying the current fraud-related 
30 variables to the predictive model; and 

means for outputting from the predictive model an output signal (1005, 807) indicating the likelihood that the 
current transaction is fraudulent. 



35 Patentanspruche 

1. Auf einem Rechner realisiertes Verfahren zum Identifizieren und Ermitteln betrugerischer Transaktionsdaten in 
einem rechnergesteuerten Transaktionsverarbeitungssystem (100) mit einer Pradiktionsmodellvorrichtung (108) 
zum Empfangen aktueller Transaktionsdaten (805), Verarbeiten der aktuellen Transaktionsdaten und Ausgeben 
40 mehrere Ausgangswerte (1005, 807), einschlieBlich einem Trefferwert, der eine Wahrscheinlichkeit einer betru- 

gerischen Transaktion wiedergibt, mit folgenden Verfahrensschritten: vor dem Empfangen der aktuellen Transak- 
tionsdaten (805) fur wenigstens eine aktuelle Transaktion: 

Erzeugen eines Verbraucherprofils fur jeden von mehreren Verbrauchern aus einer Vielzahl vergangener be- 
45 trugsbezogener Variablen ( 1 1 23) und aus Verbraucherdaten (806), wobei jedes Verbraucherprof il f ruhere Aus- 

gabemuster eines entsprechenden Verbrauchers beschreibt; wobei die vergangenen betrugsbezogenen 
riablen (1123) durch Vorverarbeiten vergangener Transaktionsdaten (804) abgeleitet werden, die vergange- 
nen Transaktionsdaten fur mehrere Transaktionsvariablen Werte fur eine Vielzahl vergangener Transaktionen 
enthalten, und die Verbraucherdaten (806) fur jeden Verbraucher Werte fur eine Vielzahl Verbrauchervariablen 
50 umfassen; 

Trainieren der Pradiktionsmodellvorrichtung (108) mit den Verbraucherprofilen und mit den vergangenen be- 
trugsbezogenen Variablen, um ein pradiktives Modell zu erhalten; und 
Speichern des erhattenen pradiktiven Modells in dem Rechner; 

55 Empfangen der aktuellen Transaktionsdaten (805) fur eine aktuelle Transaktion eines Verbrauchers; 

Empfangen von Verbraucherdaten (806), welche zu dem Verbraucher gehoren; 
Empfangen des Verbraucherprofils, welches zu dem Verbraucher gehort; 

Vorverarbeiten der erhattenen aktuellen Transaktionsdaten (805), Verbraucherdaten (806) und des Verbrau- 
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cherprofils, um aktuelle betrugsbezogene \feriablen fur die aktuelle Transaktion abzuleiten; 

Ermitteln der Wahrscheinlichkeit eines Betrugs bei der aktuellen Transaktion durch Anwenden der aktuellen 

betrugsbezogenen Variablen auf das pradiktive Modell; und 

Ausgeben eines Ausgangssignals (1005, 807)ausder Pradiktionsmodellvorrichtung (108), welches die Wahr- 
scheinlichkeit angibt, daft die aktuelle Transaktion betrugerisch ist. 

Verfahren nach Anspruch 1, bei dem der Schritt des Erzeuqens die folqenden Unterschritte umfaBt: 

Empfangen vergangener Transaktionsdaten (804) aus mehreren vergangenen Transaktionen, wobei die ver- 
gangen Transaktionsdaten Werte fOr mehrere Transaktionsvariablen vorsehen; 

Empfangen von Verbraucherdaten (806) fur jeden von mehreren Verbrauchern, wobei die Verbraucherdaten 
Werte fur eine Vielzahl Verbrauchervariablen fur jeden Verbraucher vorsehen; 

Vorverarbeiten der vergangenen Transaktionsdaten (804), um vergangene betrugsbezogenen variablen 
(1123) abzuleiten, wobei wenigstens einige der vergangenen betrugsbezogenen Variablen" in der Vielzahl der 
Variablen der vergangenen Transaktionsdaten (804) nicht vorkommen. 

Verfahren nach Anspruch 1 oder 2, bei dem ferner das empfangene Verbraucherprofil mit den empfangenen ak- 
tuellen Transaktionsdaten (805) aktualisiert wird. 

Verfahren nach einem der vorangehenden Anspruche, bei dem der Schritt des Trainierens der Pradiktionsmodell- 
vorrichtung folgenden Unterschritte umfaBt: 

Anlegen des Verbraucherprofils und der abgeleiteten vergangenen betrugsbezogenen Variablen an die Pra- 
diktionsmodellvorrichtung (108); 

Ordnen der Ausgangsdaten von der Pradiktionsmodellvorrichtung nach einer Rangordnung als eine Funktion 
einer Qualitatsmessung; 

Einstellen der Pradiktionsmodellvorrichtung als eine Funktion des Rangordnungsschrittes; 
Wtederholen der Schritte Anlegen, Ordnen nach Rangordnung und Einstellen, bis die Qualitatsmessung einen 
vorgegebenen Schwellwert uberschreitet, welcheranzeigt, daBdie Pradiktionsmodellvorrichtung angemessen 
trainiert ist. 

Verfahren nach einem der vorangehenden Anspruche, bei dem der Schritt des Trainierens der Pradiktionsmodell- 
vorrichtung das Trainieren eines neuralen Netzes (108) umfaBt, welches in mehreren Eingangsverarbeitungsele- 
menten (1001) organisiert ist, um die mehreren Datenwerte in den Transaktionsdaten zu empfangen, wobei meh- 
rere versteckte Verarbeitungselemente (1003) mit den Eingangsverarbeitungselementen (1001) verbunden sind, 
um die Transaktionsdaten zu verarbeiten, und mehrere Ausgangsverarbeitungselemente (1004) mit den verbor- 
genen Eingangselementen (1003) verbunden sind, um die mehreren Ausgangswerte (1005, 807) auszugeben. 

Verfahren nach Anspruch 5, bei dem das neurale Netz (1008) mehrere Verarbeitungselemente aufweist, welche 
uber Verbindungen miteinander verknupft sind, die durch Gewichte gekennzeichnete sind, und bei dem das Ein- 
stellen des neuralen Netzes die folgenden Unterschritte umfaBt: 

Auswahlen einer Untergruppe der Gewichte, welche abklingen sollen; und 
Abklingenlassen der ausgewahlten Untergruppe der Gewichte. 

Verfahren nach einem der vorangehenden Anspruche, bei dem die aktuellen Transaktionsdaten (805), das Ver- 
braucherprofil und die Verbraucherdaten (806) jeweils mehrere Datenelemente aufweisen, und mit den folgenden 
weiteren Schritten fur wenigstens eines der Datenelemente: 

Ermitteln eines relativen Beitragswertes des Daten-elementes zu dem Ausgangssignal, welches die Wahr- 
scheinlichkeit angibt, daft die aktuelle Transaktion betrugerisch ist; 

Ermitteln eines Grund-Codes, welcher einen Grund fur das Ausgangssignal als eine Funktion des relativen 
Beitragswertes angibt; 

Ruckgewinnen einer Erklarung, welche zu dem ermittelten Grund-Codewert gehort; 
Ausgeben eines Rechnersignals, welches den Grund-Code und die Erklarung angibt. 

Verfahren nach einem der vorangehenden Anspruche, mit den weiteren Verfahrensschritten: 
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Uberwachen eines LeistungsmaBes der Pradiktionsmodellvorrichtung (108), wobeidas LeistungsmaG wenig- 
stens eine Betrugserfassungsraten-Messung und eine falsche positive Ratenmessung umfaBt; 
Vergleichen des LeistungsmaBes mit einem vorgegebenen Leistungspegel fur das LeistungsmaB; und 
abhangig davon, daB der vorgegebene Leistungspegel das LeistungsmaG uberschreitet, Wiederholen des 
Trainierens der Pradiktionsmodellvorrichtung (108). 

9. Verfahren nach einem der vorangehenden Anspruche, bei dem die vergangenen betrugsbezogenen \foriablen 
(1123) und die aktuellen betrugsbezogenen Variablen jeweils wenigstens folgende Komponenten umfassen: 

Transaktions-Dollarmengen vergangener Transaktionen; Transaktionsdaten und Zeiten der vergangenen 
Transaktionen; 

Transaktionsbestatigungen und -verweigerungen vergangener Transaktionen; 
Risikogruppen vergangener Transaktionen; und 
Handler vergangener Transaktionen. 

10. Verfahren nach Anspruch 1 , bei dem das Trainieren der Pradiktionsmodellvorrichtung das Trainieren eines neura- 
len Netzes (108) in dem rechnergesteuerten Transaktionsverarbeitungssystem (100) umfaBt, wobei das System 
(100) einen Rechner-lesbaren Speicher (102) aufweist, und wobei das neurale Netz (108) mehrere miteinander 
verbundene Verarbeitungselemente (1002, 1003, 1004) aufweist, jedes Verarbeitungselement in einer Ebene des 
neuraten Netzes liegt, jede Ebene einen Abstand zu einer Eingangsebene hat, und jedes Verarbeitungselement 
folgende Merkmale aufweist: 

mehrere Eingange (x); 

mehrere Gewichte (w), wobei jedes Gewicht (w) einem entsprechenden Eingang (x) zugeordnet ist, um ge- 
wichtete Eingange zu bilden; 

eine Summenfunktion (902) zum Kombinieren der gewichteten Eingange; und 

eine Obertragungsfunktion (903) zum Verarbeiten der kombinierten gewichteten Eingange zu einem Ausgang 
(z); dadurch gekennzeichnet, daB die Gewichte wenigstens eines Verarbeitungselementes iterativ mit einer 
Kostenfunktion abklingen, welche eine Abklingrate zum Verringern der Gewichte als eine Funktion des Ab- 
standes der Eingangsebene von der das Verarbeitungselement enthaltenden Ebene variiert. 

11. Verfahren nach Anspruch 10, bei dem die Kostenfunktion folgende Form hat: 



D einen Datensatz wiedergibt; 

target k gibt einen Sollwert f Or ein Element k des Datensatzes wieder; 

output k gibt einen Ausgang des neuralen Netzes fOr das Element k des Datensatzes wieder; 

g gibt einen zwischenebenen Verstarkungs-Multiplikator wieder, welcher sich als eine Funktion des Abstands 

zwischen der Eingangsebene und der das Verarbeitungselement enthaltenden Ebene andert; 

X gibt die relative Wichtigkeit des Abklingratenterms wieder; 

W gibt einen Satz Gewichte wieder; 

o>j gibt einen Wert des Gewichtes i wieder; und 

c-j gibt eine Konstante wieder. 

12. Rechnergesteuertes Transaktionsverarbeitungssystem (100) mit einer Pradiktionsmodellvorrichtung (108) zum 
Empfangen aktueller Transaktionsdaten (805), Verarbeiten der Transaktionsdaten und Ausgeben mehrerer Aus- 
gangswerte (105, 807), einschlieBlich eines Trefferwertes, welcher eine Wahrscheinlichkeit einer betrugerischen 
Transaktion wiedergibt; mit einer Modellentwicklungskomponente zum Entwickeln eines pradiktiven Modells, wel- 
che folgende Merkmale aufweist: 

eine Vorrichtung zum Empfangen vergangener Transaktionsdaten (804) fur mehrere vergangene Transaktio- 




wobei 
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nen, wobei die vergangenen Transaktionsdaten Werte fur mehrere Transaktionsvariablen vorsehen; 

eine Vorrichtung zum Empfangen von Verbraucherdaten (806) fur jeden von mehreren Verbrauchern, wobei 

die Verbraucherdaten Werte fur mehrere Verbrauchervariablen fur jeden Verbraucher vorsehen; 

eine Vorrichtung zum Vorverarbeiten der vergangenen Transaktionsdaten (804), urn vergangene betrugsbe- 

5 zogene Variablen (1123) abzuleiten, wobei wenigstens einige der vergangenen betrugsbezogenen Variablen 

in den mehreren Variablen der vergangenen Transaktionsdaten (804) nicht vorkommt; 
eine Vorrichtung zum Erzeugen eines Verbraucherprofils fur jeden einzelnen Verbraucher aus den vergange- 
nen betrugsbezogenen Variablen (1123) und den empfangenen Verbraucherdaten (806), wobei das Verbrau- 
cherprofil vorhergehende Ausgabemuster des Verbrauchers beschreibt; 

10 - eine Vorrichtung zum Trainieren des padiktiven Modells mit den Verbraucherprofilen und mit den vergangenen 

betrugsbezogenen Variablen; und 

eine Vorrichtung zum Speichern des trainierten pradiktiven Modells in dem Rechner; und 

mit einer Modellanwendungskomponente zum Anwenden des trainierten pradiktiven Modells, welche folgende 
is Merkmale aufweist: 

eine Vorrichtung zum Empfangen aktuefler Transaktionsdaten (805) fur eine Transaktion eines Verbrauchers; 
eine Vorrichtung zum Empfangen von Verbraucherdaten (806), welche zu dem Verbraucher gehoren; 
eine Vorrichtung zum Empfangen des Verbraucherprofils, welches zu dem Verbraucher gehort; 
20 - eine Vorrichtung zum Vorverarbeiten aktueller Transaktionsdaten fur die Vorverarbeitung der erhaltenen ak- 

tuellen Transaktionsdaten (805) der Benutzerdaten (806) und des Verbraucherprofils, um aktuelle betrugsbe- 
zogene Variablen f Or die aktuelle Transaktion abzuleiten; 

eine Vorrichtung zum Ermitteln der Wahrscheinlichkeit eines Betrugs bei der aktuellen Transaktion durch An- 
wenden deraktuellen betrugsbezogenen Variablen auf das pradiktive Modell; 
2$ - eine Vorrichtung zum Ausgeben eines Ausgangssignals (1005, 807) aus dem pradiktiven Modell, welches die 

Wahrscheinlichkeit, daB die aktuelle Transaktion betrugerisch ist, angibt. 



Revendications 

30 

1. Precede informatique pour identifier et determiner des donnees de transactions frauduleuses dans un systeme 
de transaction informatique (100) comprenant un moyen de modeiisation predictive (108) pour recevoir des don- 
nees de transaction en cours (805), traiter les donnees de transactions en cours et fournir plusieurs valeurs de 
sortie (1005, 807) inciuant une valeur de score representant une probability de transaction frauduleuse, compre- 
ss nant les etapes suivantes : 

avant de recevoir les donnees de transaction en cours (805) pour au moins une transaction en cours : 

produire un profil de consommateur pour chacun de plusieurs consommateurs a partir de plusieurs variables 
passees associees a une fraude (1123) et a partir de donnees de consommateur (806), chaque profil de 

40 consommateur decrivant un historique des configurations de depense du consommateur correspondant ; les 

variables anterieures associees a une fraude (1123) etant associees a des donnees de transaction passees 
de pre-traitement (804), les donnees de transaction passees comprenant des valeurs pour plusieurs variables 
de transaction pour plusieurs transactions anterieures, les donnees de consommateur (806) comprenant des 
valeurs pour chaque consommateur pour plusieurs variables de consommateur ; 

45 - realiser I'apprentissage du moyen de model isation predictive (108) avec les profits de consommateur et avec 

les variables passees associees a une fraude pour obtenir un modele predictif ; et 
memoriser le modele predictif obtenu dans I'ordinateur ; 

recevoir des donnees de transaction (805) pour une transaction en cours d*un consommateur ; 
50 recevoir des donnees de consommateur (806) associees au consommateur ; 

recevoir le profil de consommateur associe au consommateur ; 

pre-traiter les donnees de transaction en cours obtenues (805), les donnees de consommateur (806) et le 
profil de consommateur pour en deduire des variables en cours associees a une fraude pour la transaction 
en cours ; 

55 determiner la probabilite de fraude dans la transaction en cours en appliquant les variables en cours associees 

a une fraude au modele predictif ; et 

fournir a partir du moyen de modeiisation predictive (108) un signal de sortie (1005, 807) indiquant la probabilite 
pour que la transaction en cours soit frauduleuse. 
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Precede selon la revendication 1, dans lequel I'etape consistant a produire un profil comprend les sous-etapes 
suivantes : 

recevoir des donnees de transaction passees (804) pour plusieurs transactions passees, les donnees de 
transaction passees fournissant des valeurs pour plusieurs variables de transaction ; 

recevoir des donnees de consommateur (806) pour chacun de plusieurs consommateurs, les donnees de 
consommateur fournissant des valeurs pour plusieurs variables de consommateur pour chaque 
consommateur ; 

pre-traiter les donnees de transaction passees (804) pour fournir des variables passees associees a une 
fraude (1123) dans lesquelles au moins certaines des variables passees associees a une fraude ne sont pas 
presentes dans la pluralite de variables des donnees de transaction passees (804). 

Precede selon la revendication 1 ou 2, comprenant I'etape consistant a mettre a jour le profil de consommateur 
recu avec les donnees de transaction courantes recues (805). 

Precede selon I'une des revendications precedentes dans lequel I'etape d'apprentissage du moyen de modelisation 
predictive comprend les etapes suivantes : 

appliquer le profil de consommateur et les variables passees obtenues associees a une fraude au moyen de 
modelisation predictive (108) ; 

ranger les donnees de sortie en provenance du moyen de modelisation predictive en fonction d'une mesure 
de qualite ; 

regler le moyen de modelisation predictive en fonction de I'etape de rangement ; et 

repeter les etapes d'application de rangement et de reglage jusqu'a ce que la mesure de qualite depasse un 
niveau predetermine indiquant que le moyen de modelisation predictive a subi un apprentissage adequat. 

Precede selon I'une des revendications precedentes dans lequel I'etape d'apprentissage du moyen de modelisation 
predictive comprend I'apprentissage d'un r6seau neuronal (108) organise sous forme d'une pluralite d'elements 
de traitement d'entree (1001) pour recevoir la pluralite de valeurs de donnees dans les donnees de transaction, 
d'une pluralite d'elements de traitement caches (1003) couples aux elements de traitement d'entree (1001) pour 
traiter les donnees de transaction, et d'une pluralite d'elements de traitement de sortie (1 004) couples aux elements 
de traitement caches (1003) pour fournir la pluralite de valeurs de sortie (1005, 807). 

Precede selon la revendication 5, dans lequel le reseau neuronal (10B) comprend plusieurs elements de traitement 
lies par des connexions caracterisees par des poids, et I'etape de reglage du reseau neuronal comprend les etapes 
suivantes : 

selectionner un sous-ensemble de poids a faire decroitre ; et 
faire decroitre le sous-ensemble choisi de poids. 

Precede selon I'une des revendications precedentes dans lequel les donnees de transaction courantes (805), le . 
profil de consommateur et les donnees de consommateur (806) comprennent chacune plusieurs Elements de 
donnees, comprenant en outre, pour au moins un des elements de donnees, les etapes suivantes : 

determiner une valeur de contribution relative de I'element de donnees sur le signal de sortie indiquant la 
probability pour que la transaction en cours soit frauduleuse ; 

determiner un code de raison qui indique une raison pour le signal de sortie en fonction de la valeur de con- 
tribution relative ; 

retrouver une explication associee a la valeur de code de raison determinee ; et 
fournir un signal d'ordinateur indicatif du code de raison et de I'explication. 

Precede selon I'une des revendications precedentes, comprenant en outre les etapes suivantes : 

surveiller une metrique de performance du moyen de modelisation predictive (108), la metrique de performan- 
ce comprenant au moins une mesure de taux de detection de fraude et une mesure de taux positif faux ; 
comparer la metrique de performance a un niveau de performance predeterminee de la metrique de 
performance ; et 

en reponse au fait que le niveau de performance predetermine depasse la metrique de performance, repeter 
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I'etape d'apprentissage du moyen de modelisation predictive (108). 

9. Proc6d6 selon Tune des revendications precedentes dans lequel les variables passees associees a une fraude 
(1123) et les variables en cours associees a une fraude comprennent au moins : 

les montants en dollars de transactions passees ; 
les dates et les heures de transactions passees ; 
les approbations et les refus de transactions passees ; 
des groupes de risques de transactions passees ; et 
les vendeurs de transactions passees. 

10. Precede selon la revendication 1 , dans lequel I'etape d'apprentissage du moyen de modelisation predictive com- 
prend Papprentissage d'un reseau neuronal (108) dans le systeme intormatique de traitement de transactions 
(100), le systeme (100) comprenant : 

une memoire lisible par un ordinateur (102) ; et 

le reseau neuronal (108) comprenant une pluralite d'elements de traitement interconnects (1002, 1003, 
1004), chaque element de traitement 6tant dans une couche du reseau neuronal, chaque couche ayant une 
distance a une couche d'entree, chaque element de traitement comprenant : 

une pluralite d'entrees (x) ; 

une pluralite de poids (w), chaque poids (w) etant associe a une entree correspondante (x) pour former 
des entrees ponderees ; 

une fonction de sommation (902) pour combiner les entrees ponderees ; et 

une fonction de transfert (903) pour traiter les entrees ponderees combinees en une sortie (z) ; 

caracterise par I'etape consistant a faire decroTtre iterativement les poids d'au moins un element de traitement 
par une fonction de cout qui fait varier une cadence de decroissance pour faire decroTtre les poids en fonction de 
la distance a la couche d'entree de la couche contenant I'element de traitement. 

11. Proc6d6 selon la revendication 10, dans lequel la fonction de cout est du type suivant : 



dans laquelle : 

D represente un ensemble de donnees ; 

target k represente une valeur de cible pour un element k de I'ensemble de donnees ; 

output k represente une sortie de reseau neuronal pour I'element k de I'ensemble de donnees ; 

g represente un multiplieur de gain intercouche qui varie en fonction de la distance entre la couche d'entree 

et la couche contenant I'element de traitement ; 

X represente I'importance relative du terme de cadence de decroissance ; 
W represente un ensemble de poids ; 
cOj represente une valeur de poids i ; et 
c t represente une constante. 

12. Systeme informatique de traitement de transactions (100) comprenant un moyen de modelisation predictive (108) 
pour recevoir des donnees de transaction courantes (805), pour traiter les donnees de transaction courantes, et 
fournir une pluralite de valeurs de sortie (1005, 807), incluant une valeur de score representant une probabilite de 
transaction frauduleuse, comprenant une composante de developpement de modfele pour developper un modeie 
predictif, comprenant : 

un moyen pour recevoir des donnees de transaction passees (804) pour ptusieurs transactions passees, les 

donnees de transaction passees fournissant des valeurs pour plusieurs variables de transaction ; 

un moyen pour recevoir des donnees de consommateur (806) pour chacun de plusieurs consommateurs, les 
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donnees de consommateur fournissant des valeurs pour plusieurs variables de consommateur pour chaque 
consommateur ; 

un moyen pour pre-traiter les donnees de transaction passees (804) pour fournir des variables passees as- 
sociees a une f raude (11 23) dans lesquelles au moins certaines des variables passees associees a une f raude 
ne sont pas presentes dans la pluralrte de variable des donnees de transaction passees (804) ; 
des moyens pour produire un profil de consommateur pour chaque consommateur individuel a partir des 
variables pass6es associees a une fraude (1123) et des donnees de consommateur recces (806), le profil de 
consommateur decrivant un historique des configurations de depenses du consommateur ; 
des moyens pour realiser I'apprentissage du modele pr6dictif avec les profils de consommateur et avec les 
variables passees liees a une fraude ; et 

des moyens pour memoriser le modele predictif ayant subi I'apprentissage dans I'ordinateur ; et 

une composante d'application de modele pour appliquer le modele predictif ayant subi I'apprentissage, 

comprenant : 

des moyens pour recevoir des donnees de transaction en cours (805) pour une transaction d'un 
consommateur ; 

des moyens pour recevoir des donnees de consommateur (806) associees au consommateur; 
des moyens pour recevoir le profil de consommateur associe au consommateur ; 

un pre-processeur de donnees de transaction en cours pour pre-traiter les donn6es de transaction en cours 
obtenues (805), les donnees de consommateur (806) et le profil de consommateur pour fournir des variables 
courantes associees a une fraude pour la transaction en cours ; 

des moyens pour determiner la probabilite de fraude dans la transaction en cours en appliquant les variables 
courantes associees a une fraude au modele pr6dictif ; et 

des moyens pour fournir a partir du modele predictif un signal de sortie (1005, 807) indiquant la probabilite 
pour que la transaction en cours soit frauduleuse. 
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